CVE-2022-22113 DayByDay CRM - Insufficient Session Expiration after Password Change
Attackers can maintain access to DayByDay CRM after a password change because existing sessions are not invalidated.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-22113?
CVE-2022-22113 is a high-severity authentication bypass vulnerability in Bottelet DaybydayCRM, published on 13 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.
Weakness: CWE-613
Which versions are affected by CVE-2022-22113?
It affects 1 product.
Products include Daybydaycrm Daybyday.
How do I fix CVE-2022-22113?
No fix has been published for CVE-2022-22113 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-22113 being exploited?
There is no known exploitation of CVE-2022-22113 in the wild and no public exploit code.
Other vulnerabilities in Bottelet DaybydayCRM
Sources
Also known as GHSA-rjr7-pjq2-v9j9.